Middleware route protection bypass in Clerk JavaScript SDK packages (CVE-2026-41248)

The `createRouteMatcher` function in `@clerk/nextjs`, `@clerk/nuxt`, and `@clerk/astro` can be bypassed by certain crafted requests, allowing those requests to skip middleware gating and reach downstream handlers such as API routes and server components. The bypass is limited to the middleware-level route-matching gate; authentication state and session integrity are not affected, and auth checks performed inside route handlers or server actions remain effective. All applications relying solely on `createRouteMatcher`-based middleware gating for access control are at risk. Affected versions: - @clerk/shared >= 2.20.17, <= 3.47.3 and >= 4.0.0, <= 4.8.0 We recommend updating to: @clerk/astro 1.5.7, 2.17.10, 3.0.15, @clerk/nextjs 5.7.6, 6.39.2, 7.2.1, @clerk/nuxt 1.13.28, 2.2.2, @clerk/shared 2.22.1, 3.47.4, 4.8.1. CVSS 9.1 · our assessment: act_now Reference: https://github.com/clerk/javascript/security/advisories/GHSA-vqx2-fgx2-5wq9 Details: https://vuln.today/cve/CVE-2026-41248